Cloud: The Rented Data Center

The cloud is someone else’s data center, exposed as APIs. The promise: no more capacity planning, no more capex — resources are provisioned in seconds, billed by use, and scaled on demand. The discipline it demands: you now manage your own infrastructure programmatically, and misconfiguration is both easier and costlier (a public bucket, a runaway autoscaler).

The Service Models

The trend is “move up the stack”: IaaS gives control but you operate the OS; serverless removes operations at the cost of control (cold starts, runtime limits, vendor lock-in). Most modern systems are a mix.

Compute: The Menu

• VMs (IaaS) — choose instance types that trade CPU, memory, and network. Right-sizing is a continuous job: over-provisioned = wasted money; under-provisioned = outages. Autoscaling groups add/remove instances on load.
• Containers (PaaS-adjacent) — run your Docker images on a managed runtime (ECS, GKE, AKS); Kubernetes abstracts the nodes.
• Serverless functions — code executed on demand, billed per invocation + duration. Ideal for event-driven, bursty, low-traffic work (webhooks, image resizing, cron jobs). The catch: cold starts (a few hundred ms to seconds after idle), execution time limits, and statelessness — no long-running processes.

Storage: The Four Shapes

The mental model: object storage for anything you’d put in a file and serve over HTTP (assets, backups, logs — paired with the CDN you met in Caching); block for the OS/data of a VM; managed DB for data that needs SQL/ACID without you running a database.

Networking: The Virtual Data Center

Every cloud tenant gets an isolated VPC (Virtual Private Cloud) — a slice of the cloud’s network:

• Subnets — ranges within the VPC; usually split public/private.
• Security groups / network ACLs — the firewalls (stateful SG rules attach to resources; stateless ACLs attach to subnets). Default deny; you open what’s needed.
• NAT gateway / public IPs — how private instances reach the internet (out) and how users reach public services (in).
• Load balancers — the front door: distribute traffic, terminate TLS, health-check instances.

The recurring question is ingress/egress: what’s reachable from the internet (ideally: only the load balancer), and what’s private (databases, internal services — never public).

Managed Services: The Modern Default

The cloud’s real product is managed services: queues (SQS/PubSub), caches (ElastiCache/Cloud Memorystore), streams (Kinesis), secrets (Secrets Manager), observability (CloudWatch/Stackdriver). The default should be use the managed service and only self-run when the managed option is genuinely wrong — because a managed queue removes an entire class of operations (HA, upgrades, patching) that you’d otherwise own.

Cost Engineering

Cloud is metered, so cost is an engineering activity:

• Tag everything — resource tags (env, team, cost-center) make bills auditable; untagged resources are invisible money.
• Right-size — the most expensive over-provisioning is memory and idle capacity. Autoscale down; schedule dev environments to stop at night.
• Leverage the lifecycle — spot/preemptible instances for batch work; object-storage tiers (infrequent access, archive) for cold data.
• Watch the network — egress bandwidth is the surprise line item; cross-region data movement is expensive.

The mental shift: cloud is cheaper at low scale, more expensive than self-managed at constant high utilization. “The cloud saves money” is a myth; “the cloud saves you from capacity planning, at a metered price” is the truth.

Practice Trajectory

1. Provision a VM and a managed database in a VPC; confirm the database is unreachable from the public internet.
2. Store a file in object storage and serve it through a CDN with cache headers.
3. Trigger a serverless function from an object-upload event; measure the cold-start latency.
4. Tag a week’s worth of resources and produce a cost breakdown by team/environment.
5. Design the networking for a 3-tier app (LB → app → db) and list the security-group rules each tier needs.

When It’s the Right Tool